From 3a3db4a7d38236ea4336951bf6960a07084487de Mon Sep 17 00:00:00 2001
From: Mick Grove <mick.grove@mongodb.com>
Date: Fri, 1 Aug 2025 17:07:13 -0700
Subject: [PATCH] New rule: Groq

---
 CHANGELOG.md        |  3 +++
 data/rules/groq.yml | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 data/rules/groq.yml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 427b527..49a5b42 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.32.0]
+- New rules: Groq
+
 ## [1.31.0]
 - New rules: Telegram bot token, OpenWeatherMap, Apify
 - New OpenAI detectors added (@joshlarsen)
diff --git a/data/rules/groq.yml b/data/rules/groq.yml
new file mode 100644
index 0000000..b232ddd
--- /dev/null
+++ b/data/rules/groq.yml
@@ -0,0 +1,34 @@
+rules:
+  - name: Groq API Key
+    id: kingfisher.groq.1
+    pattern: |
+      (?xi)
+      \b
+      (
+        gsk_[a-zA-Z0-9]{52}
+      )
+      \b
+    confidence: medium
+    min_entropy: 4.5
+    validation:
+      type: Http
+      content:
+        request:
+          method: GET
+          url: "https://api.groq.com/openai/v1/models"
+          headers:
+            Authorization: "Bearer {{TOKEN}}"
+          response_matcher:
+            - type: StatusMatch
+              status: [200]
+            - type: WordMatch
+              words:
+                - '"id"'
+                - '"data"'
+              match_all_words: true
+    references:
+      - https://console.groq.com/docs/api-keys
+      - https://console.groq.com/docs/api-reference#models
+    examples:
+      - "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"
+